_gpu_dxg_open_gate.nx source

1// _gpu_dxg_open_gate.nx -- SOVEREIGN-GPU ladder R2 (adapter-handle open from LUID). 2// 3// R0 reached the real GPU set (LX_DXENUMADAPTERS2). R1 positively IDed the discrete RTX 5080 by its 4// ADAPTERTYPE bit. R2 takes that IDENTITY (the adapter's LUID) and opens a fresh kernel ADAPTER HANDLE 5// for it through the raw /dev/dxg ioctl LX_DXOPENADAPTERFROMLUID (0xC00C4701, _IOWR(0x47,0x01,12)) -- 6// the openable handle that LX_DXCREATEDEVICE (R3) will consume to make the WDDM device. 7// 8// ABI (WSL2-Linux-Kernel linux-msft-wsl-6.6.y, include/uapi/misc/d3dkmthk.h; recon-confirmed live): 9// struct winluid { __u32 a; __u32 b; } // 8 bytes 10// struct d3dkmt_openadapterfromluid { winluid adapter_luid(@0,IN); d3dkmthandle adapter_handle(@8,OUT); } 11// 12// GREEN iff (author=organ, from REAL device returns, never $?): 13// A) enum ret==0 AND num_adapters>=2 AND exactly ONE discrete hw adapter (R1 identity holds); 14// B) open(discrete LUID) ret==0 AND opened_handle != 0; 15// C) opened discrete handle != the discrete adapter's ENUM handle (a FRESH kernel allocation, not an echo); 16// D) open(integrated LUID) ret==0 AND its handle != 0 AND != the discrete handle 17// (DISCRIMINATION: the open resolves the SPECIFIC adapter from its LUID, not "any adapter"); 18// E) TAMPER matrix, each distinct from the real ret==0 AND yielding handle==0: 19// T1 bogus LUID (0xdeadbeef) -> -EINVAL ; T2 bogus ioctl code (0x99..) ; T3 open on a non-dxg fd. 20// The fd close releases the opened adapter handles (dxgkrnl frees per-fd handles on close). 21// Marker -> knowledge/status/gpu_dxg.log (DXGOPENGATE). raw syscalls only (no libvulkan/cuda/dxcore/libc). 22// NO-WAVE: this rung proves only "open a per-adapter kernel handle from the LUID". ZERO throughput/exceed. 23// license_tier: ORIGINAL 24import "nx_syscalls.nx" 25 26const ENUM2_CODE: i64 = 0xC0104714 // LX_DXENUMADAPTERS2 27const QAI_CODE: i64 = 0xC0184709 // LX_DXQUERYADAPTERINFO (ADAPTERTYPE) 28const OAFL_CODE: i64 = 0xC00C4701 // LX_DXOPENADAPTERFROMLUID 29const OAFL_BOGUS: i64 = 0x990C4701 // magic-0x99 tamper of the open code 30 31func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } 32func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } 33func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 34func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 35// append a hex value to an already-open fd (for the log marker). 36func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } 37 38func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 { 39 let priv: *u8 = sys_mmap(64); var zz: i64 = 0; while zz < 64 { priv[zz] = 0 as u8; zz = zz + 1 } 40 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 41 let h: *i64 = (req as i64 + 0) as *i64; h[0] = (handle & 0xffffffff) | ((qtype & 0xffffffff) << 32) 42 let pd: *i64 = (req as i64 + 8) as *i64; pd[0] = priv as i64 43 let pds: *i64 = (req as i64 + 16) as *i64; pds[0] = psize & 0xffffffff 44 let ret: i64 = sys_ioctl(fd, QAI_CODE, req as i64) 45 outv[0] = (priv[0] as i64)|((priv[1] as i64)<<8)|((priv[2] as i64)<<16)|((priv[3] as i64)<<24) 46 return ret 47} 48 49func open_from_luid(fd: i64, code: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 { 50 let req: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { req[y] = 0 as u8; y = y + 1 } 51 let lo: *i64 = (req as i64 + 0) as *i64; lo[0] = (luid_lo & 0xffffffff) | ((luid_hi & 0xffffffff) << 32) 52 let ret: i64 = sys_ioctl(fd, code, req as i64) 53 outh[0] = (req[8] as i64)|((req[9] as i64)<<8)|((req[10] as i64)<<16)|((req[11] as i64)<<24) 54 return ret 55} 56 57func main() -> i64 { 58 p("=== SOVEREIGN-GPU R2 gate (raw /dev/dxg LX_DXOPENADAPTERFROMLUID -> open a per-adapter handle from the 5080 LUID) ===\n" as *u8) 59 let fd: i64 = sys_openat_rd("/dev/dxg" as *u8) 60 if fd < 0 { p("open(/dev/dxg) failed\n" as *u8); sys_exit(1); return 1 } 61 62 let ainfo: *u8 = sys_mmap(4096); var z: i64 = 0; while z < 4096 { ainfo[z] = 0 as u8; z = z + 1 } 63 let ereq: *u8 = sys_mmap(64); var y: i64 = 0; while y < 64 { ereq[y] = 0 as u8; y = y + 1 } 64 ereq[0] = 8 as u8; let r8: *i64 = (ereq as i64 + 8) as *i64; r8[0] = ainfo as i64 65 let eret: i64 = sys_ioctl(fd, ENUM2_CODE, ereq as i64) 66 let nc: i64 = (ereq[0] as i64)|((ereq[1] as i64)<<8)|((ereq[2] as i64)<<16)|((ereq[3] as i64)<<24) 67 p(" enum ret=" as *u8); n(eret); p(" num_adapters=" as *u8); n(nc); p("\n" as *u8) 68 69 // identify discrete + integrated and capture each LUID + the discrete's enum handle. 70 let v: *i64 = sys_mmap(16) 71 var n_discrete: i64 = 0 72 var disc_lo: i64 = 0; var disc_hi: i64 = 0; var disc_enumh: i64 = 0 73 var integ_lo: i64 = 0; var integ_hi: i64 = 0; var have_integ: i64 = 0 74 var ai: i64 = 0 75 while ai < nc { 76 let base: i64 = ai * 20 77 let eh: i64 = (ainfo[base] as i64)|((ainfo[base+1] as i64)<<8)|((ainfo[base+2] as i64)<<16)|((ainfo[base+3] as i64)<<24) 78 let lo: i64 = (ainfo[base+4] as i64)|((ainfo[base+5] as i64)<<8)|((ainfo[base+6] as i64)<<16)|((ainfo[base+7] as i64)<<24) 79 let hi: i64 = (ainfo[base+8] as i64)|((ainfo[base+9] as i64)<<8)|((ainfo[base+10] as i64)<<16)|((ainfo[base+11] as i64)<<24) 80 let qret: i64 = query_type(fd, eh, 15, 4, v); let t: i64 = v[0] 81 let disc: i64 = (t>>4)&1; let integ: i64 = (t>>5)&1; let sw: i64 = (t>>2)&1 82 if qret == 0 { if disc == 1 { if sw == 0 { n_discrete = n_discrete + 1; disc_lo = lo; disc_hi = hi; disc_enumh = eh } } } 83 if qret == 0 { if integ == 1 { if have_integ == 0 { integ_lo = lo; integ_hi = hi; have_integ = 1 } } } 84 ai = ai + 1 85 } 86 p(" discrete LUID=" as *u8); x(disc_hi); x(disc_lo); p(" enum_handle=" as *u8); x(disc_enumh) 87 p(" | integrated LUID=" as *u8); x(integ_hi); x(integ_lo); p("\n" as *u8) 88 89 // REAL CALLS: open the discrete adapter, then the integrated adapter, from their LUIDs. 90 let hd: *i64 = sys_mmap(16); let hi2: *i64 = sys_mmap(16) 91 let r_d: i64 = open_from_luid(fd, OAFL_CODE, disc_lo, disc_hi, hd) 92 let r_i: i64 = open_from_luid(fd, OAFL_CODE, integ_lo, integ_hi, hi2) 93 p(" open(discrete) ret=" as *u8); n(r_d); p(" handle=" as *u8); x(hd[0]); p("\n" as *u8) 94 p(" open(integrated) ret=" as *u8); n(r_i); p(" handle=" as *u8); x(hi2[0]); p("\n" as *u8) 95 96 // ---- TAMPER matrix (no-false-green): each must differ from the real ret==0 AND yield handle==0 ---- 97 let th: *i64 = sys_mmap(16) 98 let t1: i64 = open_from_luid(fd, OAFL_CODE, 0xdeadbeef, 0xdeadbeef, th); let t1h: i64 = th[0] 99 let t2: i64 = open_from_luid(fd, OAFL_BOGUS, disc_lo, disc_hi, th); let t2h: i64 = th[0] 100 let nfd: i64 = sys_openat_rd("/dev/null" as *u8) 101 let t3: i64 = open_from_luid(nfd, OAFL_CODE, disc_lo, disc_hi, th); let t3h: i64 = th[0] 102 if nfd >= 0 { sys_close(nfd) } 103 p(" [tamper] bogus-LUID ret=" as *u8); n(t1); p(" h=" as *u8); x(t1h) 104 p(" | bogus-code ret=" as *u8); n(t2); p(" h=" as *u8); x(t2h) 105 p(" | non-dxg-fd ret=" as *u8); n(t3); p(" h=" as *u8); x(t3h); p("\n" as *u8) 106 sys_close(fd) // releases the opened adapter handles (per-fd dxgkrnl cleanup) 107 108 var fresh: i64 = 0; if hd[0] != 0 { if hd[0] != disc_enumh { fresh = 1 } } 109 var discrim: i64 = 0; if hd[0] != 0 { if hi2[0] != 0 { if hd[0] != hi2[0] { discrim = 1 } } } 110 var tamper_ok: i64 = 0 111 if t1 != 0 { if t2 != 0 { if t3 != 0 { if t1h == 0 { if t2h == 0 { if t3h == 0 { tamper_ok = 1 } } } } } } 112 113 var pass: i64 = 0 114 if eret == 0 { if nc >= 2 { if n_discrete == 1 { if have_integ == 1 { 115 if r_d == 0 { if r_i == 0 { if fresh == 1 { if discrim == 1 { if tamper_ok == 1 { pass = 1 } } } } } } } } } 116 117 p(" checks: enum=" as *u8); n(eret==0); p(" discrete_count=" as *u8); n(n_discrete); p(" open_discrete_ok=" as *u8); n(r_d==0) 118 p(" open_integrated_ok=" as *u8); n(r_i==0); p(" fresh_handle=" as *u8); n(fresh); p(" discriminates=" as *u8); n(discrim); p(" tamper_ok=" as *u8); n(tamper_ok); p("\n" as *u8) 119 120 let lfd: i64 = sys_openat_append("knowledge/status/gpu_dxg.log" as *u8, 0x1a4) 121 if pass == 1 { 122 p("DXGOPENGATE verdict=GREEN reason=raw-/dev/dxg-LX_DXOPENADAPTERFROMLUID-opens-a-fresh-per-adapter-handle-from-the-5080-LUID (open ret=0; fresh handle != enum handle; discrete vs integrated LUIDs open to DISTINCT handles = LUID-specific; bogus-LUID/bogus-code/non-dxg tampers all != ret=0 with handle=0; wrapper-free) SCOPE=adapter-handle-open-only-NO-throughput; WDDM-device-create=R3\n" as *u8) 123 if lfd >= 0 { 124 fp(lfd, "DXGOPENGATE verdict=GREEN rung=R2-adapter-handle-open device=discrete-RTX5080 via=raw-/dev/dxg-LX_DXOPENADAPTERFROMLUID(0xC00C4701) discrete_luid=" as *u8); fx(lfd, disc_lo) 125 fp(lfd, " enum_handle=" as *u8); fx(lfd, disc_enumh) 126 fp(lfd, " opened_handle=" as *u8); fx(lfd, hd[0]) 127 fp(lfd, " integrated_opened_handle=" as *u8); fx(lfd, hi2[0]) 128 fp(lfd, " fresh=1 discriminates=1 tamper=rejected(bogus-luid-EINVAL+bogus-code-ENOTTY+non-dxg-ENOTTY,handle=0) wrapper-free scope=adapter-handle-open-only-NO-throughput next=R3-LX_DXCREATEDEVICE\n" as *u8) 129 sys_close(lfd) 130 } 131 sys_exit(0); return 0 132 } 133 p("DXGOPENGATE verdict=RED (one of enum/discrete-count/open-discrete/open-integrated/fresh/discriminate/tamper not satisfied)\n" as *u8) 134 if lfd >= 0 { fp(lfd, "DXGOPENGATE verdict=RED see-console\n" as *u8); sys_close(lfd) } 135 sys_exit(1) 136 return 1 137}